{"slug": "reverse-engineering-fortinet-with-ablation", "title": "Reverse Engineering Fortinet with Ablation", "summary": "Ablation is a reverse engineering framework that matches the core disassembly, decompilation, and binary analysis capabilities of Ghidra, IDA Pro, and Binary Ninja, and pairs with an LLM to operate as a fully autonomous reverse engineering tool. Ablation loads a 50 MB binary in 35 seconds by analyzing only the functions a user is actively working on, whereas Ghidra and IDA Pro can take hours by parsing the entire file into a database first. The framework adds BERT-based semantic search, Jaccard and Dynamic Time Warping version diffing, cross-binary data-flow analysis, and multi-architecture support spanning x86, ARM, MIPS, PowerPC, RISC-V, ARC, and V850.", "body_md": "Ablation is a reverse engineering framework that provides the exact same core disassembly, decompilation, and binary analysis capabilities as industry-standard tools like Ghidra, IDA Pro, and Binary Ninja. Combined with an LLM, it transforms into a fully autonomous reverse engineering tool.\n\nAblation is built for the modern landscape, and more importantly, the human.\n\nNow reverse engineering is accessible to anyone. No matter your wallet or your barrier of entry into education, you can learn about reverse engineering as you reverse engineer.\n\n```\nflowchart TD\n    Binary([\"<b>Target Binary</b><br/><i>ELF · PE · firmware</i>\"])\n    Claude([\"<b>Claude Code (Orchestrator)</b><br/><i>Central Agent Controller</i>\"])\n\n    Binary -->|\"load\"| BCtx[\"<b>BinaryContext</b><br/><i>PLT · Strings · Call Graph · XRefs</i>\"]\n    BCtx -->|\"context\"| Corpus[\"<b>Corpus Builder</b><br/><i>Semantic Embedding DB</i>\"]\n    BCtx -->|\"context\"| Taint[\"<b>Taint Engine</b><br/><i>Data Flow / Sinks</i>\"]\n    BCtx -->|\"context\"| Diffing[\"<b>Diffing Engine</b><br/><i>DTW / Version Delta</i>\"]\n    BCtx -->|\"context\"| FmtStr[\"<b>Format String</b><br/><i>Specifier Scanner</i>\"]\n    BCtx -->|\"context\"| Heap[\"<b>Heap Scanner</b><br/><i>Chunk / UAF Audit</i>\"]\n    BCtx -->|\"context\"| MultiArch[\"<b>Multi-Arch Engine</b><br/><i>MIPS · PPC · RISC-V · ARC · V850</i>\"]\n    BCtx -->|\"context\"| Driver[\"<b>Driver Engine</b><br/><i>Kernel IOCTL / BYOVD Audit</i>\"]\n\n    Corpus -->|\"embeddings\"| Semantic[\"<b>Semantic Search</b><br/><i>BERT Behavioral Fingerprints</i>\"]\n\n    Semantic -. \"candidates\" .-> Claude\n    Taint -. \"findings\" .-> Claude\n    Diffing -. \"findings\" .-> Claude\n    FmtStr -. \"findings\" .-> Claude\n    Heap -. \"findings\" .-> Claude\n    MultiArch -. \"findings\" .-> Claude\n    Driver -. \"findings\" .-> Claude\n\n    Claude -->|\"confirmed finding\"| Registry[\"<b>Finding Registry</b><br/><i>Cross-Target Corpus</i>\"]\n    Registry -->|\"seeds future sweeps\"| Semantic\n\n    classDef primary fill:#2a1a4a,stroke:#7c3aed,stroke-width:2px,color:#fff\n    classDef foundation fill:#0d1117,stroke:#58a6ff,stroke-width:2px,color:#e5e7eb\n    classDef engine fill:#171717,stroke:#404040,stroke-width:1px,color:#e5e7eb\n    classDef feedback fill:#0d2818,stroke:#238636,stroke-width:2px,color:#e5e7eb\n\n    class Claude,Binary primary\n    class BCtx foundation\n    class Corpus,Semantic,Taint,Diffing,FmtStr,Heap,MultiArch,Driver engine\n    class Registry feedback\nmindmap\n  root((Local Decompilers))\n    x86 Family\n      x86 - 32\n      x86 - 64\n    ARM Family\n      ARM - 32\n      ARM - 64\n    MIPS Family\n      MIPS 32+nM\n      MIPS - 64\n    PowerPC Family\n      PPC - 32\n      PPC - 64\n    RISC-V Family\n      RISC-V 32\n      RISC-V 64\n    Embedded / Other\n      ARC EM/HS\n      V850 - 32\n```\n\n- **Semantic Search via BERT:** Semantic search finds results based on meaning rather than exact keywords. BERT reads text and figures out what it means. Similar meanings get similar scores, so you can search by concept instead of exact words. By combining the two, it speeds up the main bottleneck of reverse engineering while finding the vulnerable functions.\n- **Extreme Performance:** A 50 MB binary loads in 35 seconds. Ghidra and IDA Pro can take hours because they parse the entire file into a database before you can do anything. Ablation only analyzes the functions you are actively working on, so you start immediately.\n- **Version Diffing:** Utilizing the Jaccard method to measure how much a function's behavior overlaps between releases and Dynamic Time Warping that tracks the \"shape\" of how a function executes across those versions of firmware or software that a vendor updated, Ablation confirms whether a patch actually changed the logic or just the packaging, because a cosmetic recompile can't hide an unpatched vulnerability.\n- **Cross-Binary Analysis:** Analyze every shared library in a firmware image simultaneously, tracking data flows across binary boundaries.\n\n- **Entropy Mapper:** Finds encrypted, compressed, or packed sections in a binary.\n- **Crypto Audit:** Scans for cryptography.\n- **XorSolver:** Recovers, then decrypts the target section which allows further reverse engineering.\n\n**Everything legacy tools have**\n\n| Feature | Ablation | Ghidra | IDA Pro | Binary Ninja | \n|---|---|---|---|---|\n| Disassembler | ✅ | ✅ | ✅ | ✅ | \n| Decompiler | ✅ | ✅ | ✅ | ✅ | \n| Scripting API | ✅ | ✅ | ✅ | ✅ | \n| Multi-Architecture | ✅ | ✅ | ✅ | ✅ | \n| Binary Diffing | ✅ | ✅ | ✅ | ✅ | \n\n**Capabilities legacy tools don't have**\n\n| Feature | Ablation | Ghidra | IDA Pro | Binary Ninja | \n|---|---|---|---|---|\n| Semantic Search | ✅ | ❌ | ❌ | ❌ | \n| Autonomous Loop | ✅ | ❌ | ❌ | ❌ | \n| Pattern Library | ✅ | ❌ | ❌ | ❌ | \n| Cross-Binary Taint Tracking | ✅ | ❌ | ❌ | ❌ | \n| Version Diffing via DTW | ✅ | ❌ | ❌ | ❌ | \n| Finding Registry | ✅ | ❌ | ❌ | ❌ | \n| Load Time (50 MB) | **35 sec** | 1-4 hrs | Heavy DB | Heavy DB | \n| Cost | **Open Source** | Free / OSS | $3,000+ | Commercial | \n\nWhen executing commands like `ablation sweep firmware.so --json results.json`, Claude Code can interpret the JSON, identify suspicious functions, and automatically pivot to run `ablation cfg` to visualize logic or `ablation taint` to verify reachability.\n\nThis ReAct loop using `claude-sonnet-5` for decompilation effectively replaces the junior analyst role during triage, surfacing only confirmed, exploitable paths for human review.\n\n**Recommended model:** `claude-sonnet-4-6` (released January 2026).\n\n```\n/model claude-sonnet-4-6\n```\n\nAblation has been used to analyze production firmware and kernel drivers from Fortinet, Cisco, Axis, Fujitsu, MikroTik, Orka, TencentOS, Enigma2, and Skydio.\n\nFollowing coordinated disclosure on Cisco FMC and ISE, the Cisco Product Security Incident Response Team (PSIRT) has adopted Ablation for internal vulnerability triage. Cisco PSIRT is actively using it to triage ongoing disclosure reports across Firepower Threat Defense (FTD), Cisco Secure Client (AnyConnect), HyperFlex, and Catalyst. Cisco Adaptive Security Appliance (ASA) LINA has also been reverse engineered using Ablation, with findings currently under coordinated triage via CERT/CC VINCE.\n\n| CVE | Product | Title | CVSS | Advisory | \n|---|---|---|---|---|\n| CVE-2026-76420 | Secure Firewall Management Center (FMC) | Peer Impersonation | 9.0 Critical | [cisco-sa-fmc2-multivulns-HXgcqRG](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG) | \n| CVE-2026-76412 | Secure Firewall Management Center (FMC) | Privilege Escalation to root | 8.5 High | [cisco-sa-fmc2-multivulns-HXgcqRG](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG) | \n| CVE-2026-76413 | Secure Firewall Management Center (FMC) | Single Sign-On Token Forgery | 8.5 High | [cisco-sa-fmc2-multivulns-HXgcqRG](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG) | \n| CVE-2026-76447 | Identity Services Engine (ISE) | OCSP Responder Authentication Bypass | 5.3 Medium | [cisco-sa-ise-multiauth-bypass-sgD2HbL4](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4) | \n\nEnd-to-end analysis of the ML native binaries bundled in FortiSOAR 8.0.0, from RPM extraction through BinaryContext, string xrefs, and capstone disassembly to confirmed findings.\n\n```\nflowchart TD\n    RPM[\"elasticsearch-8.19.19-x86_64.rpm<br/>649MB · FortiSOAR 8.0.0 third-party bundle\"]\n\n    RPM -->|rpm2cpio / cpio| EXTRACT[\"x-pack-ml/platform/linux-x86_64/\"]\n\n    EXTRACT --> PI[\"bin/pytorch_inference<br/>397KB · stripped PIE · x86-64\"]\n    EXTRACT --> CTRL[\"bin/controller<br/>128KB · stripped PIE · x86-64\"]\n    EXTRACT --> LIBS[\"lib/libMlCore.so<br/>lib/libtorch_cpu.so\"]\n\n    subgraph TRACK_PI [\"pytorch_inference track\"]\n        direction TB\n        BCI[\"BinaryContext.load_or_build()<br/>32 func starts · 551 strings · PLT built\"]\n        BCI --> SS[\"ctx.strings scan<br/>aten::from_file VA 0x51560<br/>aten::save VA 0x51570<br/>validElasticLicenseKeyConfirmed 0x52e08\"]\n        SS --> XREF[\"ctx.string_xrefs()<br/>both ops xref → 0x17499, 0x174af<br/>ctx.func_containing() → init fn 0x10000\"]\n        XREF --> DA1[\"capstone disasm 0x17450<br/>lea rsi → aten::from_file · call set::insert<br/>lea rsi → aten::save · call set::insert<br/>CONFIRMED: exactly 2 blacklist entries\"]\n        DA1 --> DA2[\"capstone disasm 0x16511<br/>cmp qword ptr [r9], 0<br/>je → model loads · ne → handleFatal<br/>empty set = bypass confirmed\"]\n    end\n\n    subgraph TRACK_LIBS [\"library analysis\"]\n        direction TB\n        NM[\"nm -D libMlCore.so<br/>spawn at 0xfdb20 · ctor at 0xfcfd0\"]\n        NM --> DA3[\"capstone disasm libMlCore.so:0xfdbc7<br/>cmp entry length == exe_path length<br/>memcmp at 0xfdbdb<br/>proper equality check · no prefix bypass\"]\n        LSCAN[\"re.findall aten:: in libtorch_cpu.so<br/>2481 distinct ops found<br/>2 blocked · 2479 unblocked\"]\n    end\n\n    subgraph TRACK_CTRL [\"controller track\"]\n        direction TB\n        BCC[\"BinaryContext.load_or_build()<br/>18 func starts · PLT · strings\"]\n        BCC --> XREF2[\"ctx.string_xrefs() on 5 path strings<br/>./autodetect · ./categorize<br/>./data_frame_analyzer · ./normalize<br/>./pytorch_inference<br/>all xref at 0x9a04-0x9a5e\"]\n        XREF2 --> DA4[\"capstone disasm 0x99e9<br/>call CProgName::progDir()<br/>call COsFileFuncs::chdir()<br/>chdir to binary dir before spawn\"]\n        DA4 --> DA5[\"capstone disasm 0x11500<br/>args vector from command pipe tokens<br/>passed raw to spawn() at 0x11699<br/>no validation\"]\n    end\n\n    PI --> BCI\n    PI --> BCC\n    LIBS --> NM\n    LIBS --> LSCAN\n\n    DA2 --> F1\n    LSCAN --> F1[\"F1 · HIGH<br/>verifySafeModel blocks 2 of 2481 ops<br/>upload malicious .pt via ML API<br/>seccomp BPF not yet decoded, CIA impact open\"]\n\n    DA3 --> F2\n    XREF2 --> F2[\"F2 · LOW<br/>controller spawn allowlist is sound<br/>but args vector unchecked<br/>requires elasticsearch user pipe access\"]\n\n    DA5 --> F2\n\n    SS --> F3[\"F3 · INFO<br/>license gate = JSON field only<br/>no cryptographic verification\"]\n\n    classDef finding fill:#1a1a2e,stroke:#e94560,stroke-width:2px,color:#fff\n    classDef tool fill:#16213e,stroke:#0f3460,stroke-width:1px,color:#e5e7eb\n    classDef binary fill:#0f3460,stroke:#533483,stroke-width:2px,color:#fff\n    classDef input fill:#533483,stroke:#7c3aed,stroke-width:2px,color:#fff\n\n    class F1,F2,F3 finding\n    class BCI,BCC,NM,LSCAN,SS,XREF,XREF2,DA1,DA2,DA3,DA4,DA5 tool\n    class PI,CTRL,LIBS binary\n    class RPM,EXTRACT input\npip install git+https://github.com/Ablation-Tool/ablation\n```\n\nWith LLM features:\n\n```\npip install \"git+https://github.com/Ablation-Tool/ablation#egg=ablation[llm]\"\n```\n\nReach out directly. If there's anything you'd like added or improved on or just report a bug.\n\n- [Open an issue](https://github.com/Ablation-Tool/ablation/issues) on GitHub\n- X: [@ablation_tool](https://x.com/ablation_tool)\n- Signal: [@deadbug.06](https://signal.me/#p/deadbug.06)\n- Email: [ablation@nuclide-research.com](mailto:ablation@nuclide-research.com)\n\n- Python >= 3.10\n- `capstone` ,`numpy` ,`lief` ,`sentence-transformers` ,`pyelftools`\n- Optional: `anthropic` for LLM features\n\nSee [LICENSE](https://github.com/Ablation-Tool/ablation/blob/main/LICENSE).\n\nNicholas Michael Kloster & Claude\n\n**Books** (All obtained from O'Reilly Media | [www.oreilly.com](https://www.oreilly.com))\n\n| Title | Author | \n|---|---|\n| The Art of Software Security Assessment | Dowd, McDonald, Schuh | \n| Practical Binary Analysis | Dennis Andriesse | \n| Practical Malware Analysis | Sikorski, Honig | \n| Practical Reverse Engineering | Dang, Gazet, Bachaalany | \n| Hacking: The Art of Exploitation (2e) | Jon Erickson | \n| Learning Linux Binary Analysis | Ryan O'Neill | \n| Windows Internals Part 1 & 2 | Yosifovich, Russinovich | \n| Rootkits: Subverting the Windows Kernel | Hoglund, Butler | \n| Advanced Compiler Design and Implementation | Muchnick | \n| Engineering a Compiler | Cooper, Torczon | \n| Security Engineering (3rd ed.) | Ross Anderson | \n| Practical IoT Hacking | Chantzis et al. | \n| The Art of Mac Malware | Patrick Wardle | \n| Mathematical Concepts and Methods in Modern Biology | Robeva, Hodge | \n\n**Research Papers**\n\n| Title | Authors | \n|---|---|\n| [Finding Taint-Style Vulnerabilities in Linux-based Embedded Firmware with SSE-based Alias Analysis](https://arxiv.org/abs/2109.12209) | Cheng, Zheng, Liu, Guan, Liu, Li, Zhu, Ye, Sun | \n| [iResolveX: Multi-Layered Indirect Call Resolution via Static Reasoning and Learning-Augmented Refinement](https://arxiv.org/abs/2601.17888) | Santra et al. | \n| [Extracting Protocol Format as State Machine via Controlled Static Loop Analysis](https://arxiv.org/abs/2305.13483) | Shi, Xu, Zhang [@qingkaishi](https://github.com/qingkaishi) | \n| [NEMETYL: Message Type Identification of Binary Network Protocols using Continuous Segment Similarity](https://arxiv.org/abs/2002.03391) | Kleber et al. [@vs-uulm](https://github.com/vs-uulm) | \n| [Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice](https://dl.acm.org/doi/10.1145/2810103.2813707) | Adrian et al. [@dadrian](https://github.com/dadrian) | \n| [Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS](https://www.usenix.org/conference/woot16/workshop-program/presentation/bock) | Böck et al. [@hannob](https://github.com/hannob) | \n| [Whitening Sentence Representations for Better Semantics and Faster Retrieval](https://arxiv.org/abs/2103.15316) | Su et al. [@bojone](https://github.com/bojone) | \n| [Constant Propagation with Conditional Branches](https://dl.acm.org/doi/abs/10.1145/103135.103136) | Wegman, Zadeck | \n| [A Simple, Fast Dominance Algorithm](https://www.cs.princeton.edu/techreports/2005/737.pdf) | Cooper, Harvey, Kennedy | \n| [libdft: Practical Dynamic Data Flow Tracking for Commodity Systems](https://dl.acm.org/doi/10.1145/2151024.2151042) | Kemerlis et al. [@vkemerlis](https://github.com/vkemerlis) | \n\n**Honorable Mention**\n\nMicrosoft Excel (Data Analysis ToolPak) When analyzing closed infrastructure or securing black-box systems, this exact process is called timing analysis or telemetry reverse engineering. Without source code, the Data Analysis ToolPak mathematically deconstructs how an application works on the backend by strictly observing its inputs and outputs.", "url": "https://wpnews.pro/news/reverse-engineering-fortinet-with-ablation", "canonical_source": "https://github.com/Ablation-Tool/ablation", "published_at": "2026-09-26 07:30:07+00:00", "updated_at": "2026-09-26 08:01:32.310108+00:00", "lang": "en", "topics": ["ai-tools", "ai-agents", "large-language-models", "developer-tools"], "entities": ["Ablation", "Ghidra", "IDA Pro", "Binary Ninja", "Claude Code", "BERT"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/reverse-engineering-fortinet-with-ablation", "markdown": "https://wpnews.pro/news/reverse-engineering-fortinet-with-ablation.md", "text": "https://wpnews.pro/news/reverse-engineering-fortinet-with-ablation.txt", "jsonld": "https://wpnews.pro/news/reverse-engineering-fortinet-with-ablation.jsonld"}}